Conventionally, when hardware (circuit) that implements a desired function is designed, logic verification to check for omissions in the design is a fundamental process before moving to manufacture of actual hardware. Specifically, a verification scenario that suits the contents of the hardware design is created, and logic verification is performed using an output result obtained when the verification scenario is input.
Furthermore, verification coverage is obtained to objectively evaluate the verification that has been performed using the verification scenario created as described above. Verification coverage is information concerning an index that indicates the sufficiency of simulation patterns for a subject of verification. Specifically, if the population is all simulation patterns requiring verification, coverage obtained from a rate of the executed simulation patterns is provided as the verification coverage. In this case, verification accuracy is determined to be high if the verification coverage is high.
A problem with this technique concerns the method of extracting “all simulation patterns requiring verification”, i.e., the population. Simulation patterns corresponding to the population are referred to as coverage standards. If patterns are extracted that are not effective practically for verification as coverage standards, the patterns do not necessarily contribute to improvement of actual verification efficiency even if the coverage of the simulation is high.
Therefore, methods called path coverage and code coverage in which patterns are comprehensively extracted according to specific standards are used nowadays. In path coverage, patterns to verify all paths causing state transitions in the register of a circuit under verification are extracted. Therefore, with the path coverage method, these patterns are the coverage standards. Code coverage is also called line coverage, and patterns are extracted to verify paths related to input and output of the register in which source codes corresponding to a circuit under verification are described. Further, in the code coverage, these patterns are the coverage standards. Such techniques are disclosed in, for example, Japanese Laid-Open Patent Publication Nos. 2006-190209 and 2006-201980, and “Assertion-Based Design” (2nd Edition) by Foster, Harry D., et al., “Programming Code metrics”, pp. 129-130, 2004.
However, even if a verification scenario comprehensive of the coverage standards as described above is created and verification is performed using the verification scenario, a bug due to an omission of verification may occur with respect to branch conditions in the circuit, even if the coverage standards described above are 100% in the verification scenario; a consequence originating in a verification oversight with respect to branch conditions in the circuit.
FIG. 20 is a schematic diagram for explaining an example of oversight concerning a conditional branch error. For example, when hardware (circuit) according to a specification in which priority is set as condition A>condition B is designed, as depicted in FIG. 20, correct description 2010 conforming to the specification may be changed to incorrect description 2020, such as when a designer makes an error when attempting to make a correction. In the correct description 2010, in an if statement 2011 to perform determination of the condition A, an if statement 2012 to perform determination of the condition B is further described.
On the other hand, in the incorrect description 2020, in an if statement 2021 to perform determination of the condition B, an if statement 2022 to perform determination of the condition A is described. Accordingly, in the incorrect description 2020, condition B>condition A, which is different from the intended implementation specified in the specification.
However, with the coverage standards described above, it is possible that a description error, such as the incorrect description 2020, is not verified. FIG. 21 is a comparison chart of correct description and incorrect description. With reference to FIG. 21, an example is explained where the correct description 2010 and the incorrect description 2020 are executed.
As depicted in a chart 2100 in FIG. 21, when the correct description 2010 and the incorrect description 2020 are compared, it is found that four patterns 2101 are executed in response to Yes/No determination results for each condition. Among the four patterns 2101, in three patterns 2102 in which the condition A and the condition B are not satisfied (Yes) at the same time, the processing to be performed is equivalent in both the correct description 2010 and the incorrect description 2020. On the other hand, only in a pattern 2103 in which the condition A and the condition B are satisfied at the same time, the processing to be performed differs.
FIG. 22 is a schematic diagram for explaining a verification scenario having 100% line coverage. Assuming the correct description 2010 is the description of a subject of verification, for a pattern in which neither the condition A nor the condition B are satisfied (No, No) in a verification scenario 2200, verification is performed for processing c of description at the deepest position (lowest level) in the correct description 2010.
Moreover, for a pattern in which only the condition B is satisfied (No, Yes), verification is performed for processing b in the correct description 2010. For a pattern in which only the condition A is satisfied (Yes, No), verification is performed for processing a of description at a shallowest position in the correct description 2010.
Therefore, as depicted in FIG. 22, all descriptions are covered by the verification scenario. As described, in the case of line coverage, even if verification for a pattern in which both the condition A and the condition B are satisfied (Yes, Yes) is not performed, the coverage becomes 100%.
Furthermore, when the path coverage described above is used as the coverage standards, because such a path having the pattern in which both the condition A and the condition B are satisfied (Yes, Yes) is not present in the correct description 2010, it is naturally be excluded from the population of the coverage standards. Therefore, similarly to the line coverage, even if verification for the pattern in which both the condition A and the condition B are satisfied (Yes, Yes) is not performed, the coverage becomes 100%.
As described, with the conventional coverage standards, coverage concerning the conditional branch in a circuit to be verified may not be completely covered even if a verification scenario that achieves 100% coverage is created.
However, a technique to confirm the coverage of conditional branches by a created verification scenario has not been provided. Therefore, if incorrect description, e.g., the incorrect description 2020 explained in FIG. 20, is included, the incorrect description cannot be extracted as a problem, and there has been a problem that hardware design inclusive of a bug is provided.